[apparmor] [PATCH 4/4] Function to test if apparmor support is enabled.

[John Johansen]

Signed-off-by: John Johansen <john.johansen at canonical.com>
---
 libraries/libapparmor/doc/aa_find_mountpoint.pod |   42 ++++++++++++++++++++
 libraries/libapparmor/src/apparmor.h             |    1 +
 libraries/libapparmor/src/kernel_interface.c     |   46 ++++++++++++++++++++++
 libraries/libapparmor/src/libapparmor.map        |    1 +
 libraries/libapparmor/swig/SWIG/libapparmor.i    |    1 +
 5 files changed, 91 insertions(+), 0 deletions(-)

diff --git a/libraries/libapparmor/doc/aa_find_mountpoint.pod b/libraries/libapparmor/doc/aa_find_mountpoint.pod
index 28f25f4..98fa276 100644
--- a/libraries/libapparmor/doc/aa_find_mountpoint.pod
+++ b/libraries/libapparmor/doc/aa_find_mountpoint.pod
@@ -22,24 +22,36 @@
 
 =head1 NAME
 
+aa_is_enabled - determine if apparmor is available
+
 aa_find_mountpoint - find where the apparmor interface filesystem is mounted
 
 =head1 SYNOPSIS
 
 B<#include E<lt>sys/apparmor.hE<gt>>
 
+B<int aa_is_enabled(void);>
+
 B<int aa_find_mountpoint(char **mnt);>
 
 Link with B<-lapparmor> when compiling.
 
 =head1 DESCRIPTION
 
+The aa_is_enabled function returns true (1) if apparmor is enabled.  If it
+isn't it sets the errno to reflect the reason it is not enabled and returns 0.
+
 The aa_find_mountpoint function finds where the apparmor filesystem is mounted
 on the system, and returns a string containing the mount path.  It is the
 caller's responsibility to free(3) the returned path.
 
 =head1 RETURN VALUE
 
+B<aa_is_enabled>
+On success 1 is returned. On error, 0 is returned, and errno(3) is set
+appropriately.
+
+B<aa_find_mountpoint>
 On success zero is returned. On error, -1 is returned, and errno(3) is set
 appropriately.
 
@@ -47,6 +59,36 @@ appropriately.
 
 =over 4
 
+B<aa_is_enabled>
+
+=item B<ENOSYS>
+
+AppArmor extensions to the system are not available.
+
+=item B<ECANCELED>
+
+AppArmor is available on the system but has been disabled at boot.
+
+=item B<ENOENT>
+
+AppArmor is available (and maybe even enforcing policy) but the interface is
+not available.
+
+=item B<ENOMEM>
+
+Insufficient memory was available.
+
+=item B<EPERM>
+
+Did not have sufficient permissions to determine if AppArmor is enabled.
+
+=item B<EACCES>
+
++Did not have sufficient permissions to determine if AppArmor is enabled.
+
+
+B<aa_find_mountpoint>
+
 =item B<ENOMEM>
 
 Insufficient memory was available.
diff --git a/libraries/libapparmor/src/apparmor.h b/libraries/libapparmor/src/apparmor.h
index 903cecd..fbfaae0 100644
--- a/libraries/libapparmor/src/apparmor.h
+++ b/libraries/libapparmor/src/apparmor.h
@@ -21,6 +21,7 @@
 __BEGIN_DECLS
 
 /* Prototypes for apparmor state queries */
+extern int aa_is_enabled(void);
 extern int aa_find_mountpoint(char **mnt);
 
 /* Prototypes for self directed domain transitions
diff --git a/libraries/libapparmor/src/kernel_interface.c b/libraries/libapparmor/src/kernel_interface.c
index 6a36a54..33fdda9 100644
--- a/libraries/libapparmor/src/kernel_interface.c
+++ b/libraries/libapparmor/src/kernel_interface.c
@@ -29,6 +29,8 @@
 #include <stdarg.h>
 #include <mntent.h>
 
+#include "apparmor.h"
+
 /* some non-Linux systems do not define a static value */
 #ifndef PATH_MAX
 # define PATH_MAX 4096
@@ -85,6 +87,50 @@ int aa_find_mountpoint(char **mnt)
 	return rc;
 }
 
+/**
+ * aa_is_enabled - determine if apparmor is enabled
+ *
+ * Returns: 1 if enabled else reason it is not, or 0 on error
+ *
+ * ENOSYS - no indication apparmor is present in the system
+ * ENOENT - enabled but interface could not be found
+ * ECANCELED - disabled at boot
+ * ENOMEM - out of memory
+ */
+int aa_is_enabled(void)
+{
+	int serrno, fd, rc, size;
+	char buffer[2];
+	char *mnt;
+
+	/* if the interface mountpoint is available apparmor is enabled */
+	rc = aa_find_mountpoint(&mnt);
+	if (rc == 0) {
+		free(mnt);
+		return 1;
+	}
+
+	/* determine why the interface mountpoint isn't available */
+	fd = open("/sys/module/apparmor/parameters/enabled", O_RDONLY);
+	if (fd == -1) {
+		if (errno == ENOENT)
+			errno = ENOSYS;
+		return 0;
+	}
+
+	size = read(fd, &buffer, 2);
+	serrno = errno;
+	close(fd);
+	errno = serrno;
+
+	if (size > 0) {
+		if (buffer[0] == 'Y')
+			errno = ENOENT;
+		else
+			errno = ECANCELED;
+	}
+	return 0;
+}
 
 static inline pid_t aa_gettid(void)
 {
diff --git a/libraries/libapparmor/src/libapparmor.map b/libraries/libapparmor/src/libapparmor.map
index df51d01..444278e 100644
--- a/libraries/libapparmor/src/libapparmor.map
+++ b/libraries/libapparmor/src/libapparmor.map
@@ -16,6 +16,7 @@ APPARMOR_1.0 {
 
 APPARMOR_1.1 {
   global:
+        aa_is_enabled;
         aa_find_mountpoint;
         aa_change_hat;
         aa_change_hatv;
diff --git a/libraries/libapparmor/swig/SWIG/libapparmor.i b/libraries/libapparmor/swig/SWIG/libapparmor.i
index 1b6b5c7..f0ebf5a 100644
--- a/libraries/libapparmor/swig/SWIG/libapparmor.i
+++ b/libraries/libapparmor/swig/SWIG/libapparmor.i
@@ -13,6 +13,7 @@
  * are manually inserted here
  */
 
+extern int aa_is_enabled(void);
 extern int aa_find_mountpoint(char **mnt);
 extern int aa_change_hat(const char *subprofile, unsigned long magic_token);
 extern int aa_change_profile(const char *profile);
-- 
1.7.5.4